Changeset 989 for vendor/current/source3/auth

Timestamp:

Nov 25, 2016, 8:04:54 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.7

Location:

vendor/current/source3/auth

Files:

• auth_generic.c (modified) (4 diffs)
• token_util.c (modified) (2 diffs)

vendor/current/source3/auth/auth_generic.c

@@ -29 +29 @@
 #ifdef HAVE_KRB5
 #include "auth/kerberos/pac_utils.h"
+#include "nsswitch/libwbclient/wbclient.h"
 #endif
 #include "librpc/crypto/gse.h"
@@ -64 +65 @@
         if (pac_blob) {
 #ifdef HAVE_KRB5
+                struct wbcAuthUserParams params = {};
+                struct wbcAuthUserInfo *info = NULL;
+                struct wbcAuthErrorInfo *err = NULL;
+                wbcErr wbc_err;
+
+                /*
+                 * Let winbind decode the PAC.
+                 * This will also store the user
+                 * data in the netsamlogon cache.
+                 *
+                 * We need to do this *before* we
+                 * call get_user_from_kerberos_info()
+                 * as that does a user lookup that
+                 * expects info in the netsamlogon cache.
+                 *
+                 * See BUG: https://bugzilla.samba.org/show_bug.cgi?id=11259
+                 */
+                params.level = WBC_AUTH_USER_LEVEL_PAC;
+                params.password.pac.data = pac_blob->data;
+                params.password.pac.length = pac_blob->length;
+
+                become_root();
+                wbc_err = wbcAuthenticateUserEx(&params, &info, &err);
+                unbecome_root();
+
+                /*
+                 * As this is merely a cache prime
+                 * WBC_ERR_WINBIND_NOT_AVAILABLE
+                 * is not a fatal error, treat it
+                 * as success.
+                 */
+
+                switch (wbc_err) {
+                        case WBC_ERR_WINBIND_NOT_AVAILABLE:
+                        case WBC_ERR_SUCCESS:
+                                break;
+                        case WBC_ERR_AUTH_ERROR:
+                                status = NT_STATUS(err->nt_status);
+                                wbcFreeMemory(err);
+                                goto done;
+                        default:
+                                status = NT_STATUS_LOGON_FAILURE;
+                                goto done;
+                }
+
                 status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
                                                  NULL, NULL, 0, &logon_info);
@@ -102 +148 @@
         }
 
-        /* save the PAC data if we have it */
+        /* Get the info3 from the PAC data if we have it */
         if (logon_info) {
                 status = create_info3_from_pac_logon_info(tmp_ctx,
@@ -110 +156 @@
                         goto done;
                 }
-                netsamlogon_cache_store(ntuser, info3_copy);
         }
 

vendor/current/source3/auth/token_util.c

@@ -673 +673 @@
         gid_t *gids;
         struct dom_sid *group_sids;
+        struct dom_sid tmp_sid;
         uint32_t num_group_sids;
         uint32_t num_gids;
@@ -754 +755 @@
 
         } else  if (sid_check_is_in_unix_users(user_sid)) {
-                struct dom_sid tmp_sid;
                 uint32_t getgroups_num_group_sids;
                 /* This is a unix user not in passdb. We need to ask nss